Show users only their own data and open projects #127
Merged
+903
−180
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The audit found places that showed data beyond a user's own projects and open projects. Each one is now limited: - Uploads: only the uploader (and admins) can list, open, attach to or process an upload; same organization is no longer enough. The DB3 pilot keeps its shared queue. - Data card: statistics cover only the runs the user can see. - Dataset snapshots: admins only (platform-wide counts). - Upload template: checks equipment visibility, 404 otherwise. - Equipment: connection host/port/database only for the owner, maintainers and admins; run counts cover only visible runs. - ML: importance and proposals use the model trained on all projects only for an admin viewing all projects; the ML cache key now tracks the user's visible projects and runs, so lost access takes effect at once. - System and ingestion tokens are compared in constant time, and an unused helper that trusted an unverified bearer value is removed. - AI assistant: dataset snapshots tool is admin-only; tool descriptions say what each returns. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A unit-experiment template marked Private is no longer visible to the rest of its owner's organization. It stays readable to its owner, to readers of a project that uses it, and to anyone who can read an experiment built on it. - The execution queue shows requests only for equipment the user owns or is a trusted maintainer of (admins: all). The same organization no longer counts. Maintainers of any role now get the queue page; the web menu asks the new /admin/execution-queue/access endpoint. - The row-level security functions app_manages_equipment and app_experiment_type_readable change the same way; the migration job re-applies the script. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign in
to join this conversation on GitHub.
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why
A signed-in user should see their own projects and data plus open (public) projects, and nothing beyond that. The data-access audit (ledger #90) found places in the web app and the AI assistant that showed more.
What changes
!=hmac.compare_digest; empty expected token never matchesresolve_request_userClosed-loop and other system jobs are unchanged.
Second commit: Navid's decisions
Changed in both the API and the row-level security functions (
app_experiment_type_readable,app_manages_equipment). NewGET /admin/execution-queue/accesstells the web menu whether to show the queue.Kept as is (decided OK): draft publication requests visible to readers of open projects;
/ml/statusshowing the global model's size and metrics.Tests
api/tests/test_data_scoping.py: 26 tests; 15 of the first 18 fail on the old code.test_rcac_gateway, also fails ondevwithout these changes. 4 modules can't be collected locally (missing pymatgen/rcac_runner/PG env).Deploy
Run the migration Job first:
add_row_level_security.sqlchanged, and the migration re-applies it (by checksum). Then rebuild dt-api (and the retrain cronjob image) and dt-web.🤖 Generated with Claude Code